Authentication tokens are commonly used for authenticating a user to a server over an insecure channel. By way of illustration, an authentication token shares one or more items of information with an authentication server, wherein such information is typically not known to other entities, and wherein such information allows the generation and verification of at least parts of an authentication string. This authentication string commonly includes, or is a function of, information that is memorized by the owner of the token and also stored on the server. The authentication can include a variety of formats, such as interactive (for example, a challenge-response format) or non-interactive (for example, no information is sent from the server to the user/token in order to complete the generation of the authentication string).
In a common scenario, information that constitutes an authentication attempt is sent over a potentially insecure communication link, such as a wireless or wired network. In one example, a user in possession of an authentication token aims to access a resource controlled by a server. The server can be assumed to be secure against attacks, thereby rendering the secret information stored by the server as precluded from being compromised and used for purposes of impersonation of the user in question. The above-mentioned resource may include, for example, a database, an electronic mail (e-mail) account, a storage unit, and/or processing ability.
Systems such as detailed above, however, may not be effective when the authentication server is not available, or may be impractical if the resource to which access is desired is a device of which the token owner is in possession. Under such circumstances, it would be beneficial if the device were able to verify the authentication code without interaction with the remote authentication server. However, if the device (such as, for example, a mobile phone or smart phone) is lost, stolen, or otherwise controlled by an attacker (or unwanted party other than the owner/user), this attacker could potentially obtain and use verification information (that is, the token) to attempt to impersonate the owner/user to the remote authentication server.
Accordingly, a need exists to protect data on a mobile device without keeping or storing the key (that is, the key responsible for encrypting the data sought for protection) on the mobile device.